Fortinet EMEA Advanced Support Exam Practice Tests 2025 | Pass EMEA-Advanced-Support with confidence!
Practice Fortinet NSE EMEA-Advanced-Support exam. Online Exam Practice Tests with detailed explanations!
NEW QUESTION # 26
Which protocols are used by an email client to retrieve emails?
- A. IMAP4
- B. SMTP
- C. SNMP
- D. POP3
Answer: A,D
Explanation:
Email clients use POP3 (Post Office Protocol) and IMAP4 (Internet Message Access Protocol) to retrieve emails from a server. POP3 downloads emails and typically removes them from the server, while IMAP4 allows synchronized access. SMTP is used for sending emails, and SNMP is for network monitoring, not email retrieval. Exact extract: "Email clients use POP3 or IMAP to retrieve email messages from a mail server... IMAP allows users to access and manage email directly on the server, while POP3 typically downloads messages to the client."
NEW QUESTION # 27
Which of the following is a network monitoring protocol?
- A. SSH
- B. RDP
- C. SNMP
- D. Telnet
Answer: C
Explanation:
SNMP (Simple Network Management Protocol) is specifically designed for monitoring and managing network devices, allowing administrators to query device status, performance metrics, and configure alerts for issues. It operates by using agents on devices that report to a central manager. In contrast, RDP is for remote desktop access, Telnet for unsecure remote command-line access, and SSH for secure remote access. SNMP is the standard protocol for network monitoring in Fortinet products like FortiGate, FortiSwitch, etc. Exact extract: SNMP enables administrators to monitor how devices are performing and make changes to network devices so that data moves through the network more efficiently. Simple Network Management Protocol (SNMP) enables you to monitor hardware on your network. The FortiSwitch SNMP implementation is read- only. Monitoring FortiAP with SNMP. You can enable SNMP directly on FortiAP by implementing a SNMPD daemon/subagent on the FortiAP side. The Simple Network Management Protocol (SNMP) allows you to monitor hardware on your network. You can configure the hardware, such as the FortiProxy SNMP agent.
NEW QUESTION # 28
Which parts of the IKE protocol below are responsible for authenticating the User (username/password) of a dialup IPsec tunnel? (Check all correct answers)
- A. IKEv1 phase1
- B. IKEv2 SA_INIT
- C. IKEv1 phase2
- D. IKEv2 EAP
- E. IKEv1 Xauth
Answer: D,E
Explanation:
For user authentication in dialup IPsec, IKEv1 uses XAuth (Extended Authentication) after Phase 1 for username/password. IKEv2 uses EAP (Extensible Authentication Protocol) for similar user auth. Phase 1 and SA_INIT are for peer auth, Phase 2 for child SA negotiation. Exact extract: XAuth increases security by requiring remote dialup client users to authenticate in a separate exchange at the end of phase 1. IPsec IKEv2 VPNs now support certificate authentication and EAP authentication at the same time from a dialup FortiClient. With the eap-cert-auth setting ... IPsec IKEv2 VPNs now support certificate authentication and EAP authentication at the same time from a dialup FortiClient. IPsec IKEv1 uses XAUTH for user authentication, and IPsec IKEv2 uses EAP for user authentication. Only EAP-TTLS is interoperable with LDAP. For LDAP based user ... In your scenario, the user cannot authenticate by providing both a PSK and their credentials (using one of multiple EAP methods).
NEW QUESTION # 29
What happens when a FortiGate's CPU enters conserve mode?
- A. Routing protocols are disabled
- B. Proxy-based inspection is disabled
- C. All traffic is blocked
- D. New sessions are dropped
Answer: B
Explanation:
When a FortiGate's CPU enters conserve mode due to high load, proxy-based inspection (e.g., web filtering, DLP) is disabled to reduce resource usage, while flow-based inspection continues. Traffic isn't fully blocked (A), new sessions may still be processed (C), and routing protocols (D) are unaffected. Exact extract: "In conserve mode, FortiGate disables proxy-based inspection to reduce CPU and memory load, switching to flow-based inspection to maintain performance."
NEW QUESTION # 30
Which of the following Authentication protocols uses clear text?
- A. CHAP
- B. MSCHAP
- C. PAP
- D. EAP
Answer: C
Explanation:
PAP (Password Authentication Protocol) sends username and password in clear text over the network, making it insecure. CHAP uses challenge-response with hash, MSCHAP is Microsoft variant with hash, EAP is extensible and can use various methods but not inherently clear text. Exact extract: It's "impossible" to authenticate wireless users based on EAP-PEAP sessions agains OpenLdap, except, if the users using clear text authetication methods (PAP). Clear text HTTP authentication is not secure. All user names and data (and, depending on the authentication style, passwords) are sent in clear text. If you ... Fortinet ... Password Authentication Protocol (PAP). Used to authenticate PPP connections. Transmits passwords and other user information in clear text. The default token page contains a "Token Code:" text field. Recommended customization. It's recommended to delete the "Token Code:" text. FortiWeb will use ... If you follow the configuration guide for NPS you'll see (step 9) you need to enable "Unencrypted authentication (PAP, SPAP)" (link below).
NEW QUESTION # 31
Which Router in an OSPF Domain sends a Type-4 Summary LSA
- A. Stub Routers only
- B. ASBR
- C. ABR
- D. All OSPF Routers
Answer: C
Explanation:
In OSPF, the Area Border Router (ABR) generates Type-4 Summary LSAs to advertise the location of an Autonomous System Boundary Router (ASBR) to other areas. This LSA informs routers in different areas how to reach the ASBR for external routes. ASBR generates Type-5 LSAs for external routes, but ABR summarizes them with Type-4. Not all routers or stub routers do this. Exact extract: This article describes the basic steps to configure FortiGates in an OSPF scenario where the FortiGates will be ABR and ASBR OSPF routers across 3 areas. Router3 is the Autonomous System Border Router (ASBR). It routes all traffic to the ISP BGP router for internet access. It redistributes routes from BGP and ... Type 4 LSAs exist to let the area know the router-id of the ASBR, so the routers can look at the type 5 route, find advertising-router, and map
... An ASBR summary LSA is generated by an ABR and describes the location of an ASBR (Autonomous System Boundary Router) that connects to an external network. The FortiGate in the middle shall be a ABR between the two areas. But I don't want R2 in area 0.0.0.0 to have every /32 route for every VPN client. So I tried ...
NEW QUESTION # 32
Which FortiGate feature allows for policy-based routing?
- A. Dynamic Routes
- B. Static Routes
- C. SD-WAN Rules
- D. Policy Routes
Answer: D
Explanation:
Policy Routes in FortiGate allow routing decisions based on criteria like source, destination, or service, overriding the default routing table. SD-WAN Rules (A) are for WAN optimization, Static Routes (C) are fixed, and Dynamic Routes (D) are protocol-based, not policy-based. Exact extract: "Policy Routes allow FortiGate to make routing decisions based on user-defined criteria, such as source/destination IPs or services, overriding standard routing."
NEW QUESTION # 33
What happens when a FortiGate detects a SYN flood attack?
- A. It applies rate limiting to SYN packets
- B. It drops all incoming packets
- C. It enables proxy-based inspection
- D. It redirects traffic to a backup gateway
Answer: A
Explanation:
When FortiGate detects a SYN flood attack, it applies rate limiting to SYN packets via a DoS policy, dropping excessive packets to mitigate the attack. It does not drop all packets (A), enable proxy inspection (B), or redirect traffic (D). Exact extract: "FortiGate mitigates SYN flood attacks using DoS policies, which apply rate limiting to SYN packets to prevent overwhelming the system."
NEW QUESTION # 34
Which of the below technology(ies) could reduce CPU load and memory utilization used by an IPS engine?
- A. Using IPS sensors and IPS filter to determine which traffic should be examined for which signatures, instead of examine network traffic for all signatures
- B. Using multiple engines, aligned with load balancing technologies like Turbo that uses round robin algorithms to dispatch traffic up to specific IPS engine
- C. All of the above
- D. Using regular instead of extended database, to reduce memory footprint
- E. IPS does not compare traffic to each signature individually. Instead it compiles them into a decision tree
Answer: A,D,E
Explanation:
IPS efficiency is improved by: A) Compiling signatures into a decision tree to reduce comparison overhead; B) Using IPS sensors/filters to selectively apply signatures to relevant traffic, reducing unnecessary processing; D) Using a regular database instead of an extended one to lower memory usage. Option C's
"Turbo" and round-robin load balancing is not a standard Fortinet IPS feature. Option E is incorrect as C is not valid. Exact extract: "IPS efficiency is improved by compiling signatures into decision trees to minimize CPU usage... IPS sensors and filters allow selective signature application to reduce processing... Using the regular signature database instead of extended reduces memory footprint."
NEW QUESTION # 35
In Active FTP who sends the PORT command?
- A. Both
- B. There is no PORT command in Active FTP
- C. The FTP Server
- D. The FTP Client
Answer: D
Explanation:
In Active FTP, the client sends the PORT command to the server, specifying an ephemeral port for the server to initiate the data connection back to the client. This distinguishes Active FTP from Passive FTP, where the server provides the port. The server does not send PORT, and the command is a key part of Active FTP. Exact extract: "In Active FTP, the client sends a PORT command to the server, specifying the IP address and port number for the data connection... The server then initiates the data connection to the client's specified port."
NEW QUESTION # 36
Which FortiGate feature allows inspection of encrypted SSL/TLS traffic?
- A. Application Control
- B. Deep Packet Inspection
- C. SSL Inspection
- D. Web Filtering
Answer: C
Explanation:
FortiGate's SSL Inspection feature decrypts and inspects SSL/TLS traffic to detect threats or enforce policies, using techniques like full SSL inspection or certificate inspection. Deep Packet Inspection (A) is a broader term, Application Control (C) identifies apps, and Web Filtering (D) blocks URLs, not specific to SSL. Exact extract: "SSL Inspection allows FortiGate to decrypt and inspect SSL/TLS traffic to detect hidden threats or enforce security policies, supporting full or certificate-based inspection."
NEW QUESTION # 37
A Company is running an outdated version of a Webserver software that is vulnerable to multiple code execution and injection attacks. Which Security feature can protect the Webserver until the security patches are applied?
- A. Intrusion Prevention System
- B. Anti rootkit Protection
- C. Intrusion Detection System
- D. Anti-virus Protection
Answer: A
Explanation:
An Intrusion Prevention System (IPS) actively blocks malicious traffic, such as code execution or injection attacks, by matching against known signatures or anomalies, protecting the webserver until patches are applied. Intrusion Detection System (IDS) only detects and alerts, not blocks. Anti-virus and anti-rootkit are less effective for web-based attacks. The original document's answer B is incorrect, as IDS does not prevent attacks. Exact extract: "IPS provides active protection by blocking malicious traffic based on signatures or anomaly detection... Unlike IDS, which only detects and alerts, IPS can drop packets to prevent attacks like code execution or SQL injection."
NEW QUESTION # 38
A firewall receives an out-of-order packet in a TCP session after the FIN/ACK and the packet is dropped as expected. What parameter can be changed to prevent such drops?
- A. TCP time-wait timer
- B. TCP close-wait timer
- C. TCPMSS
- D. Enable TCP option
Answer: A
Explanation:
Out-of-order packets after FIN/ACK indicate a packet arriving in the TIME_WAIT state, where the session is closing. The TCP time-wait timer controls how long the firewall keeps the session in the TIME_WAIT state to handle late packets. Increasing this timer allows the firewall to accept such packets instead of dropping them. Close-wait timer relates to a different state, TCPMSS affects packet size, and "Enable TCP option" is not a standard parameter. Exact extract: "The TCP time-wait timer determines how long a session remains in the TIME_WAIT state to handle out-of-order or retransmitted packets after FIN/ACK... Adjusting this timer can prevent drops of late-arriving packets."
NEW QUESTION # 39
Hybrid cloud means that
- A. The cloud provider uses AMD, Intel and possibly also other CPU vendors
- B. Cloud provider provides both 32-bit and 64-bit virtual machines
- C. Some of the customer's systems are virtualized in the public cloud and some are in the local datacenter
- D. One customer uses VMs with multiple different operating systems in the same cloud account
Answer: C
Explanation:
A hybrid cloud combines on-premises infrastructure (local datacenter) with public cloud resources, allowing workloads to operate across both environments for flexibility and scalability. Fortinet solutions like FortiGate- VM support hybrid cloud deployments. Option A refers to hardware diversity, C to OS variety, and D to architecture types, none of which define hybrid cloud. Exact extract: "Hybrid cloud is the combination of public cloud services with an on-premises private cloud or datacenter... This allows customers to run some systems in the public cloud and others in their local datacenter, managed seamlessly."
NEW QUESTION # 40
Link aggregation allows network devices to________
- A. Increase bandwidth by binding physical interfaces into a single channel
- B. Increase bandwidth of an interface
- C. None of the above
- D. Restrict the bandwidth
Answer: A
Explanation:
Link aggregation, also known as IEEE 802.3ad or 802.1ax, enables the binding of multiple physical interfaces to form a single logical interface, which increases the overall bandwidth and provides redundancy. This is achieved by combining the bandwidth of the individual links into one aggregated link. For example, if two
1Gbps interfaces are aggregated, the logical link can provide up to 2Gbps bandwidth. This configuration is commonly used in FortiGate devices to enhance network performance without replacing hardware. The option B correctly describes this by stating "Increase bandwidth by binding physical interfaces into a single channel," which aligns with the official description. Incorrect options include A, which is vague and does not specify the method of binding multiple interfaces; C, which is the opposite of the purpose; and D, which is invalid.
Exact extract: Link aggregation (IEEE 802.3ad/802.1ax) enables you to bind two or more physical interfaces together to form an aggregated (combined) link. This new link ... Link aggregation combines multiple physical interfaces into a single logical interface, increasing bandwidth and link redundancy. Traffic is distributed evenly.
NEW QUESTION # 41
Client is connected to firewall via link with MTU 1500 bytes, server is connected to firewall via link with MTU 1496 bytes. The firewall is rewriting both sender and receiver tcp-mss to 1450 bytes. What maximum size of IP packets are we going to see when client connects to server?
- A. 1450 bytes
- B. 1496 bits
- C. 1500 bytes
- D. 1450 bits
- E. 1496 bytes
- F. 1500 bits
Answer: A
Explanation:
The TCP MSS (Maximum Segment Size) defines the maximum TCP payload size, excluding headers. When the firewall sets MSS to 1450 bytes, the TCP segment size is limited to this value. For IP packets, the total size includes the TCP header (20 bytes) and IP header (20 bytes), so 1450 (MSS) + 20 (TCP) + 20 (IP) = 1490 bytes, which fits within both link MTUs (1500 and 1496 bytes). Thus, the maximum IP packet size is not limited by the link MTUs but by the MSS, adjusted for headers. Options C and F (bits) are incorrect units; A and B exceed the MSS limit. Exact extract: "The TCP MSS is adjusted to prevent fragmentation... FortiGate can rewrite the MSS in TCP SYN packets to ensure the total IP packet size (including IP and TCP headers) does not exceed the configured value."
NEW QUESTION # 42
In FortiGate, what is the purpose of the 'set webfilter-profile' command in a firewall policy?
- A. Sets the web server authentication profile
- B. Configures the web proxy settings
- C. Enables deep packet inspection for web traffic
- D. Applies a web filtering profile to block or allow URLs
Answer: D
Explanation:
The 'set webfilter-profile' command applies a web filtering profile to a firewall policy, enabling URL blocking or allowing based on categories or specific URLs. It does not enable DPI (B), configure proxies (C), or set authentication (D). Exact extract: "The 'set webfilter-profile' command applies a web filtering profile to a firewall policy, controlling access to websites based on URL categories or specific URLs."
NEW QUESTION # 43
......
Get instant access to EMEA-Advanced-Support practice exam questions: https://drive.google.com/open?id=1lkiBCJGkIXeBvYzlqIbjDN_1dKIMBv0b
The best EMEA-Advanced-Support exam study material and preparation tool is here: https://www.exam4tests.com/EMEA-Advanced-Support-valid-braindumps.html